When your retrieval pipeline becomes the attack surface.
RAG systems retrieve documents and pass them directly into model context, trusting that retrieved content is safe. That implicit trust is the vulnerability. RAG Shield screens every retrieved chunk before it reaches the model.
Your vector store is only as safe as every document in it.
Adversarial content planted in your knowledge base.
Any system that ingests external documents: web scrapers, document uploads, email attachments, shared knowledge bases. Each is a poisoning target. A single document containing embedded instructions can influence every query that retrieves it. Because RAG systems pass retrieved content directly into context, the model has no way to distinguish poisoned chunks from legitimate ones.
Retrieval itself can be weaponized.
Attackers who understand your retrieval system can craft queries, or plant documents that consistently surface adversarial content at the top of results. The model receives clean-looking chunks ranked as highly relevant, with adversarial instructions embedded in what appears to be the most authoritative retrieved context.
Enterprise RAG systems frequently ingest content from shared repositories, wikis, or third-party data feeds. Any contributor to those sources, internal or external, can plant a Trojan document. The attack doesn’t require access to your infrastructure; it only requires access to a document source your RAG system trusts.
Detection at a new trust boundary.
Currently in late-stage development. Expected GA: Q3 2026.
RAG Shield applies the same mechanism-based detection engine that powers Prompt Shield, Voice Agent Shield, AI Agent Shield, and MCP Shield to a new trust boundary: the retrieval pipeline. Detection categories and integration patterns are being shaped with early-access customers; the underlying primitive, read structure, not phrasing, is unchanged.
While RAG Shield is in development, four surfaces are live.
Be the first to know when RAG Shield ships.
Currently in late-stage development. Expected GA: Q3 2026. Early-access customers get direct input on detection categories.